A
A
Anton Kikot2014-04-17 09:54:33
logstash
Anton Kikot, 2014-04-17 09:54:33

Is it possible in Logstash multiline codec to use boolean variables and, or?

Good afternoon
Is it possible to use boolean variables in Logstash multiline codec when describing pattern? As you can see from the example below, a log comes to me from the file, which contains the key values ​​for which the log should be sewn into separate blocks and transferred to the database as different documents.
Example: values ​​to apply when stitching
input {
file {
# codec => "plain"
codec => multiline {
pattern => ["T0_INPUT_XML]|[someinfo]|[check]|[time]|[cashier]|[" ] #sew to next T0_INPUT_
negate => true
what => next
}
path => "/home/logs/*.log"
start_position => "beginning"
tags => "from_file"
}
The whole problem is that before the next _INPUT_, the log may contain either _OUTPUT_ or another value "T" (T1_, for example, which is capable of accepting INPUT / OUTPUT values), which must also be transferred as separate documents. Accordingly, for the pattern field, I want to set several processing templates separated by a logical "or". Has anyone encountered something similar? Can you give examples?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
Anton Kikot, 2014-04-17
@Neolithik

Asked the question and answered it myself

input {
   file {
#       codec => "plain"
        codec => multiline {
        pattern => "^\b(T0_OUTPUT_XML)?|(T0_INPUT_XML)" ##создаем патерны (теги) по которым будет разбираться простыня
        negate => true
        what => "previous" ##определяет положение сшивающего тега(в данном случае в начале листа тег и инфа до следующего указаного в патерне)если ставить "next" то патерн попадает в предыдущий лист
        }
        path => "/home/logs/*.log"
        start_position => "beginning" ## определяет откуда начинать читать лист и в какой очеердности оно прилитает в вебинтерфейс в данном случае зеркалка.. надо исправить: -) 
        tags => "from_file"   
        type => xml_log
        }
}

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question